EKZ Stealer credential exfil via POST to /service/save.php on 83.138.53.110

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•1

Detects network activity associated with the EKZ Stealer malware, specifically an HTTP POST request used to exfiltrate base64-encoded credentials to a known malicious destination at 83.138.53.110/service/save.php.